Indirect Prompt Injection Arena

What it measures

Forty-one agent scenarios derived from a 272,000-attempt public competition on concealed indirect prompt injection.

Primary metric

concealed attack success rate (%) - lower is safer

Judge model

not judged by a model

Human baseline

—not reportedNo human agent baseline is defined. The source evidence is adversarial competition success against model-based agents.

Languages

English

Health

The public competition had 464 participants, 272,000 attack attempts, 8,648 successful attacks, 13 frontier models, and 41 scenarios. Timeline points use overall competition ASR, not curated transfer ASR; lower is safer. Timeline dates are model public-launch dates, not competition or evaluation dates.

Status evidence

This is a current, agent-level security benchmark with tool, coding, and browser scenarios; every tested frontier model was vulnerable in the 2026 competition.

Saturated since

not saturated

Refresh cycle

continuous

Test set public

yes

The open release includes 41 behaviors and 95 attacks across 28 behaviors, while production evaluation should add private scenarios, rotate untrusted-content locations, and keep tool side effects sandboxed.

Models scored on this benchmark

The reverse lookup, which is this site’s addition: every model here with a score on this benchmark. Independent measurements and vendor-reported numbers are kept apart rather than interleaved, because they are different claims.

No model on this site has a score on this benchmark yet. That usually means the models that were measured on it are not in the registry, rather than that nobody has run it.

Trajectory